Known vulnerabilities in Craft CMS - page 7

Software: Craft CMS
Software CPE: cpe:2.3:a:pixel_and_tonic:craft_cms:*:*:*:*:*:*:*:*
Total vulnerabilities: 142
Public exploits: 13
Known exploited (KEV): 4

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Craft CMS Craft CMS is affected by 142 known vulnerabilities: 1 critical, 13 high, 54 medium, 74 low Critical High Medium Low

Vulnerabilities (142)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU153024 - Exposure of sensitive information to an unauthorized actor
CVE-2026-109304
CWE-200 Medium
No
No
4.18.7, 5.10.14 30.09.2026 SB20260930107
#VU153023 - Improper Neutralization of Special Elements Used in a Template Engine
CVE-2026-109305
CWE-1336 Medium
No
No
5.10.14 30.09.2026 SB20260930107
#VU152983 - Improper Control of Generation of Code ('Code Injection')
CVE-2026-109308
CWE-94 Medium
No
No
4.18.7, 5.10.14 30.09.2026 SB20260930107
#VU134657 - Authorization Bypass Through User-Controlled Key
CVE-2026-29069
CWE-639 Medium
No
No
4.17.0, 5.9.0 16.06.2026 SB2026021831
#VU133305 - Exposure of sensitive information to an unauthorized actor
CVE-2026-56384
CWE-200 Medium
No
No
4.17.8, 5.9.14 03.06.2026 SB2026060343
#VU133304 - Improper Control of Generation of Code ('Code Injection')
CVE-2026-56382
CWE-94 Low
Available
No
5.9.14 03.06.2026 SB2026060343
#VU133303 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-56394
CWE-22 Medium
No
No
4.17.7, 5.9.13 03.06.2026 SB2026060342
#VU129392 - Improper Neutralization of Special Elements Used in a Template Engine
CVE-2026-28784
CWE-1336 Low
No
No
4.16.18, 5.8.22 04.05.2026 SB2026050445
#VU129391 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-56381
CWE-79 Low
No
No
5.8.22 04.05.2026 SB2026050445
#VU126482 - Time-of-check Time-of-use (TOCTOU) Race Condition
CVE-2026-27127
CWE-367 Low
No
No
4.16.19, 5.8.23 17.04.2026 SB20260417106
#VU126481 - Server-Side Request Forgery (SSRF)
CVE-2026-27129
CWE-918 Low
No
No
4.16.19, 5.8.23 17.04.2026 SB20260417106
#VU126480 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-56383
CWE-79 Low
No
No
4.16.19, 5.8.23 17.04.2026 SB20260417106
#VU126479 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-27126
CWE-79 Low
No
No
4.16.19, 5.8.23 17.04.2026 SB20260417106
#VU126478 - Time-of-check Time-of-use (TOCTOU) Race Condition
CVE-2026-27128
CWE-367 Low
No
No
4.16.19, 5.8.23 17.04.2026 SB20260417106
#VU124289 - Missing Authorization
CVE-2026-33161
CWE-862 Medium
No
No
4.17.8, 5.9.14 24.03.2026 SB2026032462
#VU124288 - Missing Authorization
CVE-2026-33162
CWE-862 Medium
No
No
5.9.14 24.03.2026 SB2026032462
#VU124287 - Missing Authorization
CVE-2026-56385
CWE-862 Medium
No
No
4.17.8, 5.9.14 24.03.2026 SB2026032462
#VU124286 - Authorization Bypass Through User-Controlled Key
CVE-2026-33160
CWE-639 Medium
No
No
4.17.8, 5.9.14 24.03.2026 SB2026032462
#VU124284 - Exposure of sensitive information to an unauthorized actor
CVE-2026-33158
CWE-200 Medium
No
No
4.17.8, 5.9.14 24.03.2026 SB2026032462
#VU124283 - Missing Authentication for Critical Function
CVE-2026-33159
CWE-306 Medium
No
No
4.17.8, 5.9.14 24.03.2026 SB2026032462


Showing elements 121 - 140 out of 142